DNS-based threat detection testing tool for GCP environments.
- GCP Compute Engine VM with
roles/logging.viewerIAM permission - Python 3.8+
# Copy specific folder to VM
gcloud compute scp --recurse threat_detection_simulator/ VM_NAME:~/ --zone=ZONE --tunnel-through-iap
# Run analysis
gcloud compute ssh VM_NAME --zone=ZONE --tunnel-through-iap
cd threat_detection_simulator && chmod +x run.sh && ./run.sh debug basic# Clone repository to VM
gcloud compute ssh VM_NAME --zone=ZONE --tunnel-through-iap
git clone https://github.com/infobloxopen/ib-threat-detection-simulator.git
cd ib-threat-detection-simulator/threat_detection_simulator && chmod +x run.sh && ./run.sh debug basic./run.sh debug basic ./run.sh debug advanced
./run.sh info basic ./run.sh info advanced
./run.sh debug basic ./run.sh info advanced
- First Parameter:
debug|info(log level) - Second Parameter:
basic|advanced(analysis mode)
The tool generates analysis files in category_output/:
threat_detection_results.csv- Main results summarythreat_event_*.json- Per-category threat eventslogs/threat_detection_simulator.log- Execution logs
Domain Category,Client DNS Query Domain,Total Threat Count,Detection Rate (%)
Phishing,50,50,100.00
DGA_Malware,15,15,100.00
Malicious_Domains,50,50,100.00
TOTAL,115,115,100.00Your VM needs the Compute Engine default service account with:
roles/logging.viewerIAM role- "Allow full access to all Cloud APIs" scope
# Get project number
PROJECT_NUMBER=$(gcloud projects describe PROJECT_ID --format="value(projectNumber)")
# Grant logging permissions
gcloud projects add-iam-policy-binding PROJECT_ID \
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
--role="roles/logging.viewer"# Test from VM
gcloud logging read "timestamp>=2024-01-01" --limit=1# Check service account
gcloud compute instances describe VM_NAME --zone=ZONE \
--format="value(serviceAccounts[0].email)"
# Should return: PROJECT_NUMBER-compute@developer.gserviceaccount.comThe script has a 10-minute timeout. For slower VMs or regions, this is normal for advanced analysis modes.